You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2008/09/24 22:03:56 UTC

[Bug 5987] New: ALL_TRUSTED uses forged EHLO instead of real IP address

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987

           Summary: ALL_TRUSTED uses forged EHLO instead of real IP address
           Product: Spamassassin
           Version: unspecified
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: major
          Priority: P3
         Component: Rules
        AssignedTo: dev@spamassassin.apache.org
        ReportedBy: linux.news@bucksch.org


Using internal_networks / trusted_networks, you can configure which networks
are yours. I did that, and a spammer forged the public IP address of the mail
server (probably using EHLO), and the ALL_TRUSTED rules triggered.

ALL_TRUSTED has a score of about -1.5.

http://wiki.apache.org/spamassassin/Rules/ALL_TRUSTED states:
"If your message hits on the ALL_TRUSTED rule, it means that all of the
Received: headers in the message were inserted by SMTP relays you have
indicated are "TrustedRelays" and the "from" part of the Received: header is
also from one of your "TrustedRelays"; consequently, no tests of the source of
the message (for example, tests against DNSBlocklists) will be performed."

The offending spam:
Return-Path: <fe...@comcast.net>
...
Received: from [1.2.3.4] (unknown [67.212.189.117])
        by mail.example.com (Postfix) with SMTP id AEDE0303C57C
        for <me...@example.com>; Tue, 23 Sep 2008 12:50:31 +0200 (CEST)
Message-ID: <20...@comcast.net>
From: "=?windows-1255?B?4/L6IOT5+OXvIA==?="
<ke...@comcast.net>
To: <me...@exmaple.com>
Reply-To: "=?windows-1255?B?4/L6IOT5+OXvIA==?="
<keithsoncfapcssiks_123@comcast.
net>
Subject:
=?windows-1255?B?7Ozu5eMg7OPh+CDh+fT6IOTi5eLsLi4u5Obu8OQg7OT49uD6IO7h5e
Ag4efp8O0gIQ==?=
Date: Tue, 23 Sep 2008 05:50:30 -0500
X-Priority: 1
Importance: Highest
X-Mailer: Email Marketer Business Edition 1.90
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_476_2892_13059721.
22605925"
EM-Campaign: {23876CB5-3361-4001-9DCF-8E9691B8241F}
EM-Task: 36
X-Spam-Status: No, score=0.4 required=8.0 tests=ALL_TRUSTED,HTML_MESSAGE,
        MIME_QP_LONG_LINE autolearn=no version=3.2.4
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on
        mail.example.com

This message is in MIME format with multi-part. Since your mail reader does not
understand this format, some or all of this message may not be legible.

------=_NextPart_476_2892_13059721.22605925
...

For privacy, I replaced the real hostname, IP address and email address with IP
address 1.2.3.4 and example.com. In the actual mail, 1.2.3.4 was the IP address
of the mail server (mail.example.com).

You can see from the Received: line:
Received: from [1.2.3.4] (unknown [67.212.189.117]) by mail.example.com ...
that the spammer pretended to have the IP of my own server. 1.2.3.4 is of
course internal and trusted, but here, it's forged. Postfix did log the real IP
address, though, which was 67.212.189.117.

The bug is that ALL_TRUSTED apparently used 1.2.3.4 and not 67.212.189.117 to
reason about the origin server.

Before you say that this is not what this rule is about:
1. The wiki docs above say "the from part of the Received: header is also from
one of your TrustedRelays". This was not true for me.
2. It makes no sense in this case to assign a score of -1.5 to the email.
There's no reason to believe that this might be ham. Therefore, no matter how
defined, the rule assigns a wrong score, as-is.


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #1 from Ben Bucksch <li...@bucksch.org>  2008-09-24 13:04:13 PST ---
Compare bug 5856


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #12 from Ben Bucksch <li...@bucksch.org>  2008-09-25 06:45:33 PST ---
Well, then it's a Debian/Ubuntu or spamass-milter bug, because I have a
standard configuration.

Thanks for the links. I'll investigate further later.


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #5 from Ben Bucksch <li...@bucksch.org>  2008-09-24 14:55:35 PST ---
OK, I you asked for it :).

Return-Path: <fe...@comcast.net>
Received: from murder ([unix socket])
         by volte (Cyrus v2.2.12-Gentoo) with LMTPA;
         Tue, 23 Sep 2008 12:50:32 +0200
X-Sieve: CMU Sieve 2.2
Received: from mail.example.com (localhost [127.0.0.1])
        by internal.example.org (Postfix) with ESMTP id 2BB8141C4A791
        for <me...@internal.example.org>; Tue, 23 Sep 2008 12:50:32 +0200 (CEST)
Received: from [1.2.3.4] (unknown [67.212.189.117])
        by mail.example.com (Postfix) with SMTP id AEDE0303C57C
        for <me...@example.org>; Tue, 23 Sep 2008 12:50:31 +0200 (CEST)
Message-ID: <20...@comcast.net>
From: "=?windows-1255?B?4/L6IOT5+OXvIA==?="
<ke...@comcast.net>
To: <me...@example.org>
Reply-To: "=?windows-1255?B?4/L6IOT5+OXvIA==?="
<ke...@comcast.net>
Subject:
=?windows-1255?B?7Ozu5eMg7OPh+CDh+fT6IOTi5eLsLi4u5Obu8OQg7OT49uD6IO7h5eAg4efp8O0gIQ==?=
Date: Tue, 23 Sep 2008 05:50:30 -0500
X-Priority: 1
Importance: Highest
X-Mailer: Email Marketer Business Edition 1.90
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_476_2892_13059721.22605925"
EM-Campaign: {23876CB5-3361-4001-9DCF-8E9691B8241F}
EM-Task: 36
X-Spam-Status: No, score=0.4 required=8.0 tests=ALL_TRUSTED,HTML_MESSAGE,
        MIME_QP_LONG_LINE autolearn=no version=3.2.4
X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-01-01) on
        mail.server.beonex.com

This message is in MIME format with multi-part. Since your mail reader does not
understand this format, some or all of this message may not be legible.

------=_NextPart_476_2892_13059721.22605925
Content-Type: text/plain; charset=windows-1255
Content-Transfer-Encoding: quoted-printable

=F9=EC=E5=ED=20=EC=EA,

=F7=E9=E3=E5=ED=20=E5=F9=E9=E5=E5=F7=20=E0=FA=F8=E9=ED=20=E1=E0=E9=F0=E8=F8=F0=
=E8
=E4=F4=EA=20=EC=E0=E7=E3=20=E4=EE=F7=F6=E5=F2=E5=FA=20=E4=E9=E5=F7=F8=FA=E9=E9=
=ED=20=E5=E4=F8=E5=E5=E7=E9=E9=ED=20=E1=E9=E5=FA=F8.
=E4=EE=E5=EE=E7=E9=ED=20=E9=EC=EE=E3=E5=20=E2=ED=20=E0=E5=FA=EA=20=EC=E3=E1=F8=
=20=E2=E5=E2=EC=E9=FA=20!

=EE=EB=EC=EC=FA=20=E3=F2=FA=20=E4=F9=F8=E5=EF=20=96=2020=20=F9=F0=E4=20=E1=E4=
=E3=F8=EB=FA=20=EE=E7=F9=E1=E9=ED,=20=EE=F6=E9=F2=E4=20=EC=EB=ED
=F7=E5=F8=F1=20=F7=E9=E3=E5=ED=20=E5=F9=E9=E5=E5=F7=20=E0=FA=F8=E9=ED=20=E1=E0=
=E9=F0=E8=F8=F0=E8.


=E4=F7=E5=F8=F1=20=E4=E9=F0=E5=20=E4=EE=F7=F6=E5=F2=E9=20=E5=E4=EE=F7=E9=F3=20=
=E1=E9=E5=FA=F8=20=E1=E0=F8=F5=20=E5=E1=F0=E9=E4=E5=EC=E5=20=F9=EC=20=EE=F8=20=
=F0=E9=F8=20=F9=E9=20=EE=F0=EB"=EC=20Nearme,=20
=EE=E8=E5=E1=E9=20=E4=EE=F7=E3=EE=E9=ED=20=E4=EE=F7=F6=E5=F2=E9=E9=ED=20=E1=E9=
=F9=F8=E0=EC.
=20
=E4=EC=E9=EE=E5=E3=E9=ED=20=E9=FA=F7=E9=E9=EE=E5=20=E1=E0=E9=E6=E5=F8=20=E4=F9=
=F8=E5=EF=20/=20=F6=F4=E5=EF=20...=20=EC=E1=E7=E9=F8=FA=EA=20!
=20
=EC=F7=E1=EC=FA=20=F4=F8=E8=E9=ED=20=F0=E5=F1=F4=E9=ED=20=20=EC=E7=F6=E5=20=EB=
=E0=EF



=E4=E8=E5=E1=E9=ED=20=E5=E4=E8=E5=E1=E5=FA=20=EC=20-=20Google,
=E1=E5=E0=E5=20=EC=F9=EB=F0=F2=20=E0=E5=FA=F0=E5=20=F9=E2=ED=20=E0=FA=ED=20=E9=
=EB=E5=EC=E9=ED=20!
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=20
=E0=ED=20=E0=E9=F0=EA=20=EE=F2=E5=F0=E9=E9=EF/=EE=F2=E5=F0=E9=E9=F0=FA=20=EC=
=F7=E1=EC=20=EE=E0=E9=FA=F0=E5=20=F4=F8=F1=E5=EE=E5=FA=20=E1=E3=E9=E5=E5=F8=20=
=E9=F9=E9=F8,=20=E1=E0=EE=F6=F2=E5=FA=20=E4=E3=E5=E0=F8=20=E4=E0=EC=F7=E8=F8=E5=
=F0=E9
=EE=F1=E5=E2=20=E6=E4,=20=E0=F0=E0=20=EC=E7=F6=E5=20=EB=E0=EF=20=EC=E4=F1=F8=
=E4=20=EE=F8=F9=E9=EE=E5=FA=E9=F0=E5,=20=FA=E5=E3=E4.=20

=F2=EC=20=F4=E9=20=E7=E5=F7=20=96=20=E0=E3=ED=20=F9=EC=E0=20=EE=E1=F7=F9=20=E4=
=F1=F8=FA=20=EB=FA=E5=E1=FA=E5=20=E1=E4=FA=F8=E0=E5=FA=20=E7=E5=E6=F8=E5=FA=20=
=E9=E9=E7=F9=E1=20=EB=EE=E9=20=F9=E1=E9=F7=F9=20=EC=F7=E1=EC
=EE=E9=E9=EC=E9=ED=20=F4=F8=F1=E5=EE=E9=E9=ED=20=E0=EC=E5.
=F2=EC=20=E0=F3=20=E4=E0=EE=E5=F8=20=96=20=FA=E5=EB=EC=20=EC=E4=F1=E9=F8=20=F2=
=F6=EE=EA=20=E1=EB=EC=20=F9=EC=E1.

------=_NextPart_476_2892_13059721.22605925
Content-Type: text/html; charset=windows-1255
Content-Transfer-Encoding: quoted-printable

<HTML=20XMLNS:O><HEAD><TITLE>=EC=EC=EE=E5=E3=20=EC=E3=E1=F8=20=E1=F9=F4=FA=20=
=E4=E2=E5=E2=EC...=E4=E6=EE=F0=E4=20=EC=E4=F8=F6=E0=FA=20=EE=E1=E5=E0=20=E1=E7=
=E9=F0=ED=20!</TITLE>
<META=20http-equiv=3DContent-Type=20content=3D"text/html;=20charset=3Dwindow=
s-1255">
<META=20content=3D"Email=20Marketer=20Message=20Editor"=20name=3DGENERATOR>
<STYLE=20type=3Dtext/css>
body,table,td,tr,p,input=20{font-family:=20Verdana,=20Arial,=20Helvetica,=20=
Sans-Serif;=20font-size:=2011px}
hr=20{height:=201px}
</STYLE>

</HEAD>
<BODY>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=F9=EC=E5=
=ED<SPAN=20style=3D"COLOR:=20navy">=20</SPAN>=EC=EA,</SPAN><B><SPAN=20dir=3Dl=
tr=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O:P></SPAN></=
B></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><B>=
<SPAN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><BR>=F7=
=E9=E3=E5=ED=20=E5=F9=E9=E5=E5=F7=20=E0=FA=F8=E9=ED=20=E1=E0=E9=F0=E8=F8=F0=E8=
<O:P></O:P></SPAN></B></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=E4=F4=EA=
=20=EC=E0=E7=E3=20<B><SPAN=20style=3D"COLOR:=20#3366ff">=E4=EE=F7=F6=E5=F2=E5=
=FA=20=E4=E9=E5=F7=F8=FA=E9=E9=ED=20=E5=E4=F8=E5=E5=E7=E9=E9=ED=20=E1=E9=E5=FA=
=F8.<O:P></O:P></SPAN></B></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><B>=
<SPAN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=E4=EE=
=E5=EE=E7=E9=ED=20=E9=EC=EE=E3=E5=20=E2=ED=20=E0=E5=FA=EA=20=EC=E3=E1=F8=20=E2=
=E5=E2=EC=E9=FA=20!</SPAN></B><B><SPAN=20dir=3Dltr=20style=3D"FONT-SIZE:=2011=
pt;=20FONT-FAMILY:=20Arial"><O:P></O:P></SPAN></B></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><BR><B>=EE=
=EB=EC=EC=FA=20=E3=F2=FA=20=E4=F9=F8=E5=EF</B>=20&ndash;=2020=20=F9=F0=E4=20=E1=
=E4=E3=F8=EB=FA=20=EE=E7=F9=E1=E9=ED,=20=EE=F6=E9=F2=E4=20=EC=EB=ED<O:P></O:P=
></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><B>=
<SPAN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=F7=E5=
=F8=F1=20=F7=E9=E3=E5=ED=20=E5=F9=E9=E5=E5=F7=20=E0=FA=F8=E9=ED=20=E1=E0=E9=F0=
=E8=F8=F0=E8</SPAN></B><SPAN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT=
-FAMILY:=20Arial">.<BR=20style=3D"mso-special-character:=20line-break"><BR=20=
style=3D"mso-special-character:=20line-break"></SPAN><SPAN=20dir=3Dltr=20styl=
e=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=E4=F7=E5=
=F8=F1=20=E4=E9=F0=E5=20=E4=EE=F7=F6=E5=F2=E9=20=E5=E4=EE=F7=E9=F3=20=E1=E9=E5=
=FA=F8=20=E1=E0=F8=F5=20=E5=E1=F0=E9=E4=E5=EC=E5=20=F9=EC=20=EE=F8=20=F0=E9=F8=
=20=F9=E9=20=EE=F0=EB"=EC=20</SPAN><B><SPAN=20dir=3Dltr=20style=3D"FONT-SIZE:=
=2011pt;=20FONT-FAMILY:=20Arial">Nearme</SPAN></B><SPAN=20dir=3Drtl></SPAN><S=
PAN=20dir=3Drtl></SPAN><SPAN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT=
-FAMILY:=20Arial"><SPAN=20dir=3Drtl></SPAN><SPAN=20dir=3Drtl></SPAN>,=20<O:P>=
</O:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=EE=E8=E5=
=E1=E9=20=E4=EE=F7=E3=EE=E9=ED=20=E4=EE=F7=F6=E5=F2=E9=E9=ED=20=E1=E9=F9=F8=E0=
=EC.</SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P><SPAN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Ari=
al">
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><U>=
<SPAN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=E4=EC=
=E9=EE=E5=E3=E9=ED=20=E9=FA=F7=E9=E9=EE=E5=20=E1=E0=E9=E6=E5=F8=20=E4=F9=F8=E5=
=EF=20/=20=F6=F4=E5=EF=20...=20=EC=E1=E7=E9=F8=FA=EA</SPAN></U><SPAN=20lang=3D=
HE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=20!</SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P></SPAN>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20dir=3Dltr=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=EC=F7=E1=
=EC=FA=20=F4=F8=E8=E9=ED=20=F0=E5=F1=F4=E9=ED<SPAN=20style=3D"mso-spacerun:=20=
yes">&nbsp;=20</SPAN><B><SPAN=20style=3D"COLOR:=20#3366ff"><A=20href=3D"http:=
//www.aamedia10.info/form.asp?LinkId=3D60513613172023399421&messageId=3D36213=
276504927329664"><SPAN=20title=3Dhttp://www.aamedia10.info/form.asp?LinkId=3D=
60513613172023399421&messageId=3D36213276504927329664=20style=3D"COLOR:=20#33=
66ff">=EC=E7=F6=E5=20=EB=E0=EF</SPAN></A><O:P></O:P></SPAN></B></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><BR=20st=
yle=3D"mso-special-character:=20line-break"><BR=20style=3D"mso-special-charac=
ter:=20line-break"><O:P></O:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=E4=E8=E5=
=E1=E9=ED=20=E5=E4=E8=E5=E1=E5=FA=20=EC=20-=20</SPAN><B><SPAN=20dir=3Dltr=20s=
tyle=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">Google</SPAN></B><SPAN=20d=
ir=3Drtl></SPAN><SPAN=20dir=3Drtl></SPAN><SPAN=20lang=3DHE=20style=3D"FONT-SI=
ZE:=2011pt;=20FONT-FAMILY:=20Arial"><SPAN=20dir=3Drtl></SPAN><SPAN=20dir=3Drt=
l></SPAN>,<O:P></O:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">=E1=E5=E0=
=E5=20=EC=F9=EB=F0=F2=20=E0=E5=FA=F0=E5=20=F9=E2=ED=20=E0=FA=ED=20=E9=EB=E5=EC=
=E9=ED=20!</SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><SPAN=20=
lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial">&nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=208pt;=20FONT-FAMILY:=20Arial"><FONT=20s=
ize=3D1>=E0=ED=20=E0=E9=F0=EA=20=EE=F2=E5=F0=E9=E9=EF/=EE=F2=E5=F0=E9=E9=F0=FA=
=20=EC=F7=E1=EC=20=EE=E0=E9=FA=F0=E5=20=F4=F8=F1=E5=EE=E5=FA=20=E1=E3=E9=E5=E5=
=F8=20=E9=F9=E9=F8,=20=E1=E0=EE=F6=F2=E5=FA=20=E4=E3=E5=E0=F8=20=E4=E0=EC=F7=E8=
=F8=E5=F0=E9<O:P></O:P></FONT></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=208pt;=20FONT-FAMILY:=20Arial"><FONT=20s=
ize=3D1>=EE=F1=E5=E2=20=E6=E4,=20<B><SPAN=20style=3D"COLOR:=20#3366ff"><A=20h=
ref=3D"http://www.aamedia10.info/ERF.asp?messageId=3D70543276266228859926"><S=
PAN=20title=3Dhttp://www.aamedia10.info/ERF.asp?messageId=3D70543276266228859=
926=20style=3D"COLOR:=20#3366ff;=20TEXT-DECORATION:=20none;=20text-underline:=
=20none">=E0=F0=E0=20=EC=E7=F6=E5=20=EB=E0=EF=20=EC=E4=F1=F8=E4</SPAN></A></S=
PAN></B>=20=EE=F8=F9=E9=EE=E5=FA=E9=F0=E5,=20=FA=E5=E3=E4.</FONT></SPAN><SPAN=
=20lang=3DHE=20style=3D"FONT-SIZE:=208pt"><FONT=20face=3D"Times=20New=20Roman=
"><FONT=20size=3D1><FONT=20face=3DArial>&nbsp;<BR><BR>=F2=EC=20=F4=E9=20=E7=E5=
=F7=20&ndash;=20=E0=E3=ED=20=F9=EC=E0=20=EE=E1=F7=F9=20=E4=F1=F8=FA=20=EB=FA=E5=
=E1=FA=E5=20=E1=E4=FA=F8=E0=E5=FA=20=E7=E5=E6=F8=E5=FA=20=E9=E9=E7=F9=E1=20=EB=
=EE=E9=20=F9=E1=E9=F7=F9=20=EC=F7=E1=EC<O:P></O:P></FONT></FONT></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=209pt;=20FONT-FAMILY:=20David"><FONT=20f=
ace=3DArial=20size=3D1>=EE=E9=E9=EC=E9=ED=20=F4=F8=F1=E5=EE=E9=E9=ED=20=E0=EC=
=E5.<BR>=F2=EC=20=E0=F3=20=E4=E0=EE=E5=F8=20&ndash;=20=FA=E5=EB=EC=20=EC=E4=F1=
=E9=F8=20=F2=F6=EE=EA=20=E1=EB=EC=20=F9=EC=E1.</FONT><SPAN=20style=3D"mso-spa=
cerun:=20yes"><FONT=20face=3DArial=20size=3D1>&nbsp;<BR><BR></FONT></SPAN></S=
PAN></P></FONT></SPAN></SPAN></SPAN>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"></SPAN>&=
nbsp;</P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=2011pt;=20FONT-FAMILY:=20Arial"><O:P></O=
:P></SPAN></P>
<P=20class=3DMsoNormal=20dir=3Drtl=20style=3D"MARGIN:=200cm=200cm=200pt"><SP=
AN=20lang=3DHE=20style=3D"FONT-SIZE:=208pt;=20COLOR:=20black;=20FONT-FAMILY:=20=
Arial"><A=20title=3Dhttp://www.aamedia10.info/ERF.asp?messageId=3D70543276266=
228859926=20href=3D"http://www.aamedia10.info/ERF.asp?messageId=3D70543276266=
228859926"><FONT=20title=3Dhttp://www.aamedia10.info/ERF.asp?messageId=3D7054=
3276266228859926=20size=3D1><SPAN=20title=3Dhttp://www.aamedia10.info/ERF.asp=
?messageId=3D70543276266228859926=20style=3D"COLOR:=20black"></SPAN></FONT></=
A><U><FONT=20size=3D1></FONT></U><O:P></O:P></SPAN></P></BODY></HTML>

------=_NextPart_476_2892_13059721.22605925--


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #11 from mouss <mo...@netoyen.net>  2008-09-25 06:35:47 PST ---
if the spamassassin command generates a different result, then you have
different setups. make sure to check your spamd setup for trusted_networks and
the like. at this point, it looks like you have a configuration problem, rather
than an SA bug.


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #8 from mouss <mo...@netoyen.net>  2008-09-24 16:05:58 PST ---
if you run Bourne shell (/bin/sh or bash..., but not csh nor tcsh), just do

spamassassin -D -t 2>&1 < message.file | tee output

alternatively, run the script command
$ script
$ spamassassin ....
$ exit

and you'll see the transcript in a file named typescript.


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #9 from Ben Bucksch <li...@bucksch.org>  2008-09-24 16:18:36 PST ---
When I do that, I see no ALL_TRUSTED in the result. (not going to attach it,
because takes too long to sanitize.)

So, I think it has something to do with the setup. I use postfix (before-queue)
-> spamass-milter -> spamc -> spamd.

There installation is ubuntu, with straight spamassassin and spamass-milter
packages installed, with the following lines in /etc/postfix/main.cf:
milter_default_action = accept
smtpd_milters = unix:/spamass/spamass.sock
#smtpd_milters = unix:/var/spool/postfix/spamass/spamass.sock without chroot

Spamass command lines, per ps ax:
/usr/sbin/spamass-milter -P /var/run/spamass/spamass.pid -f -p
/var/spool/postfix/spamass/spamass.sock -u spam -i 127.0.0.1 -b
spam@example.org -e local -m -r 5 (options customized)
/usr/bin/perl -T -w /usr/sbin/spamd -D --username=spam --groupname=nogroup
--create-prefs --max-children 5 --helper-home-dir -d
--pidfile=/var/run/spamass/spamd.pid (default ubuntu, apart from username)
/usr/bin/perl -T -w /usr/bin/spamassassin -D -t (default ubuntu)


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #3 from Ben Bucksch <li...@bucksch.org>  2008-09-24 14:02:44 PST ---
No, I cannot repeat the situation, because this was a real spam. I got this
only once. I can only try to fake the situation.

Irregardless of what you see with -D, there *is* a problem, because the
X-Spam-Status shows that the ALL_TRUSTED rule fired, and that's wrong, because
it's a spam and it did not come from trusted servers.


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #2 from mouss <mo...@netoyen.net>  2008-09-24 13:49:24 PST ---
running it here with -D does not show a problem:

[74776] dbg: received-header: parsed as [ ip=67.212.189.117 rdns=
helo=!91.121.103.130! by=mail.example.com ident= envfrom= intl=0 \
id=AEDE0303C57C auth= msa=0 ]
[74776] dbg: received-header: relay 67.212.189.117 trusted? no internal? no
msa? no
[74776] dbg: metadata: X-Spam-Relays-Trusted:
[74776] dbg: metadata: X-Spam-Relays-Untrusted: [ ip=67.212.189.117 rdns=
helo=!91.121.103.130! by=mail.example.com ident= envfrom=\
 intl=0 id=AEDE0303C57C auth= msa=0 ]
[74776] dbg: metadata: X-Spam-Relays-Internal:
[74776] dbg: metadata: X-Spam-Relays-External: [ ip=67.212.189.117 rdns=
helo=!91.121.103.130! by=mail.example.com ident= envfrom= \
intl=0 id=AEDE0303C57C auth= msa=0 ]

so the IP is used, not the helo (I've used my IP in place of 1.2.3.4), and
ALL_TRUSTED doesn't fire.

can you run spamassassin with -D and show how it parsed the relays (as above)?

@Ben: no this is different than #5856. internal is to be used ro "zombie"
checks (PBL, ... etc), but not for ALL_TRUSTED.


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #7 from Ben Bucksch <li...@bucksch.org>  2008-09-24 15:47:21 PST ---
No, I can't. I tried, but I don't know how to see the debug output, it's not in
syslog. I'm in #spamassassin on freenode.


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987


Justin Mason <jm...@jmason.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID




--- Comment #10 from Justin Mason <jm...@jmason.org>  2008-09-25 02:06:37 PST ---
(In reply to comment #9)
> When I do that, I see no ALL_TRUSTED in the result. (not going to attach it,
> because takes too long to sanitize.)
> So, I think it has something to do with the setup. I use postfix (before-queue)
> -> spamass-milter -> spamc -> spamd.

You need to ensure the external MTA (postfix?) generates a Received header.
see also:


http://wiki.apache.org/spamassassin/SpamassNotFirstHop

http://wiki.apache.org/spamassassin/MtaIntegrationDevNotes

http://mail-archives.apache.org/mod_mbox/spamassassin-users/200412.mbox/<11...@mail.camerontech.com>

http://mail-archives.apache.org/mod_mbox/spamassassin-users/200412.mbox/<Pi...@d-is00.icaen.uiowa.edu>


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #4 from Sidney Markowitz <si...@sidney.com>  2008-09-24 14:34:40 PST ---
Ben,

Can you post the complete sanitised spam as an attachment? Looking at the
Received header parsing I see that it is very complex with branches for
handling Exim and so on, and at least some of the sections look like they might
have this bug of choosing the wrong IP address. If you post the complete spam
we can try to debug where SpamAssassin is getting it wrong. From comment #2 it
appears that just the headers you posted by themselves do not pinpoint the
problem




-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 5987] ALL_TRUSTED uses forged EHLO instead of real IP address

Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5987





--- Comment #6 from mouss <mo...@netoyen.net>  2008-09-24 15:43:34 PST ---
can you run it (a copy of the message) through spamassassin -D to see how your
SA parsed the relays. I don't see the problem but I run 3.2.5, not 3.2.4. 


-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.